About Garry Cooper

Garry Cooper · 08-05-2026

We are trying to setup Cisco Identity Services Engine Passive Identity Connector using the admin guide 3.4 we have deployed 2 new servers runnintg the pic agents that are running on windows 2025 these are trying to query domain controllers running wi...

Garry Cooper · 07-10-2026

We are experiencing an issue with Cisco Secure Client when users connect from sites utilizing GovWifi (a local government service for accessing central services).Current Setup & Behavior:Split Tunneling: Enabled for Microsoft services.Internet Access...

Garry Cooper · 03-26-2026

Previously, we used eStreamer to send logs to an eNcore client on the syslog server. Now that eNcore has reached end-of-life, what is Cisco’s recommended approach, and how can we configure log forwarding to ensure our cybersecurity systems continue r...

Garry Cooper · 02-11-2026

We are attempting to allow Microsoft Intune traffic through our Firepower appliance running version 7.7.10. However, the traffic is being inspected by Snort and is reported as blacklisted. Even though the relevant objects, URLs, FQDNs, application fi...

Garry Cooper · 02-02-2026

In the process of getting Microsoft Intune workig but hit a wall with the cleints hitting"Drop-reason: (snort-blacklist) Packet is blacklisted by snort, Drop-location: frame inspect_dp_snort_snp_drop_frame_wcaller:61 flow (NA)/NA"A prefilter is no go...

Garry Cooper · 08-06-2026

Just for info we run ISE 3.4 and the agent can be deployed from there. its not the standalone agent.

Garry Cooper · 08-06-2026

Thanks Rob.Our account manager pointed me to the agent.....I will research what replaces it if anything.

Garry Cooper · 08-06-2026

We want use passive id for security reasons.Our server and security team had reservations on installing the agent on the DC's which makes sense.

Garry Cooper · 08-05-2026

Thanks for the reply Mark, but we are on patch 6 now I did ask TAC and they came back with this so got our server guys to take a look.The logs identify an authorization issue on both domain controllers, not a connectivity failure:error querying event...

Garry Cooper · 04-01-2026

We have resolved the logging issue. thanks fro all the replies.Option we used was in the advanced option within the ACP and created an Action alert this pushes the logs to the syslog server and includes the intrusion events.

Member Since	‎07-12-2011 03:22 AM
Date Last Visited	‎08-06-2026 01:09 AM
Posts	122
Total Helpful Votes Received	28

User Statistics

User Activity

Cisco Identity Services Engine Passive Identity Connector Issue

Cisco Secure Client and GovWifi Connectivity Issues.

How can we forward logs from our Firepower 3130 to a syslog server?

Microsoft Intune Traffic Blocked by Snort Despite ACP Configuration

Firepower Blacklisting Traffic

Re: Cisco Identity Services Engine Passive Identity Connector Issue

Re: Cisco Identity Services Engine Passive Identity Connector Issue

Re: Cisco Identity Services Engine Passive Identity Connector Issue

Re: Cisco Identity Services Engine Passive Identity Connector Issue

Re: How can we forward logs from our Firepower 3130 to a syslog server